Modifying Series 11 (AK2025/ATJ2111/3/5) Device Research Thread

lolita · #1 (**permalink**) 20th Jun 2009, 9:35 pm

In this thead we will attempt to modify the existing s1mp3 tools to work with these new Series 11 devices with the AK2025/ATJ2111/3/5 controllers.

These new designs have a different USB and NAND flash controller, but the same ADFU protocol is used. Existing tools will be able to set these devices to ADFU mode but proceed no further.

The first thing we'll need to understand these devices more is to get a dump of the BROM. This would originally be done with s1giveio, however the existing version doesn't work for the reasons explained above. Here is a new, untested version of s1giveio which may work with these new devices:

Download s1giveio for v11 ALPHA here

THIS IS ONLY FOR THOSE WISHING TO TRY THE PROCEDURES BELOW ON A V11 DEVICE WITH THE AK2025 OR ATJ2111/3/5 CONTROLLER. IT WILL NOT WORK ON OTHER VERSIONS AND MAY CAUSE DAMAGE. THE AUTHOR DISCLAIMS ALL RESPONSIBILITY FOR THE USE OF THIS TOOL.

The commands to get a dump of the BROM in s1giveio are as follows:

Code:

o 1 0
o 2 0
t 8000 8000
q

This will generate a file named dump8000.txt. Post that file here as an attachment if you want to help out.

uncleshred · #2 (**permalink**) 24th Jun 2009, 12:24 pm

That worked well.
This is the dump8000.txt file.
I thank you for the help.

lolita · #3 (**permalink**) 25th Jun 2009, 1:06 am

Thanks for your contribution. It would be helpful to post what the actual chip is, since there may be several different ones in the 11 series. Getting several other BROM dumps from other s11 players will help as well.

This indicates that my hypothesis about where the USB controller registers have moved is correct, and the USB still functions the same otherwise. We will now analyze the BROM to determine how the NAND controller functions.

uncleshred · #4 (**permalink**) 25th Jun 2009, 5:35 am

I am not certain which chip it is that you need identified. I posted pictures of the circuit board here.

Let me know if there is anything else you need.

speser · #5 (**permalink**) 25th Jun 2009, 7:01 am

thanks for your help with this, I have attached my dump file.

Now my question is what can I do with it :o) I guess I will need to wait before I could use the s1res with it. Thank you for your help with all this so far though, it is always great to have people like you helping hte little guys out. I used to do Assembly Programming a long time ago but it is all starting to look like greek to me.

speser · #6 (**permalink**) 25th Jun 2009, 4:51 pm

I was thinking, if the Utility updater (4.21) can access the player, can you uncode it or the dlls to to find out more about how it all works?

lolita · #7 (**permalink**) 26th Jun 2009, 12:37 am

Quote:

Originally Posted by uncleshred

I am not certain which chip it is that you need identified. I posted pictures of the circuit board here.

The square one.

Quote:

Now my question is what can I do with it

) I guess I will need to wait before I could use the s1res with it. Thank you for your help with all this so far though, it is always great to have people like you helping hte little guys out. I used to do Assembly Programming a long time ago but it is all starting to look like greek to me.

It's a hexdump, so we convert it back to binary and then use a disassembler to get readable code. The CPU is Z80-compatible. For more information on the overall architecture etc., read the articles on wiki.s1mp3.org.

We hope to start analyzing the BROMs at the beginning of next week. Depending on the changes that have been made, the time until we can get the existing tools to work with these devices may vary, so have patience.

vicnaum2 · #8 (**permalink**) 26th Jun 2009, 9:28 am

Great! It worked!

Here's my dump. The info about the player is inside.

mdjava · #9 (**permalink**) 28th Jun 2009, 9:17 pm

Here is my dump text file:

I have an ipod Nano 4th Gen clone, represented as 8gb. I can't tell if it has 4 or 2 GB, it seems to act up no matter what I do.

By the way, what's the safest way to open up these units? I don't see any place where there are screws to loosen.

Thanks for working on this problem.

uncleshred · #10 (**permalink**) 29th Jun 2009, 5:56 am

Quote:

By the way, what's the safest way to open up these units? I don't see any place where there are screws to loosen.

Mine has two small screws in the bottom. Pull out the bottom end and then push the guts out the top. The display cover may have to be peeled off first, can't quit remember. It is just stuck on with sticky adhesive.